Digital Forensics: Analyzing Systems with Live-Forensicator

What it is

Live-Forensicator is a live response toolkit for Windows, Linux and macOS. Its Windows entry point is Forensicator.ps1. The Hackers Arise walkthrough tests it on Windows only. The page does not say how the Linux and macOS versions are run.

How it works

A run writes a new directory in the current folder. Open reports/index.html in it for an overview page with jump links to each section. The Event Log section groups events by category. In the example, it showed 4624 (successful logon), 4798 (user group membership lookup), 4799 (security group members listed) and 4688 (process creation). A risk summary rates the host, rated high in the example, and gives its reasons.

AI analysis is off by default. When enabled, each finding is sent to the model once it is built, so a run makes one model call per finding. If the model is unreachable, collection still finishes and the affected rows have no verdict. In the report, open a finding and use the tooltip labeled AI Analysis. On Windows the tool also builds an Investigation Summary with a risk score, a rough timeline and next steps.

Preconditions / Affected

• Admin PowerShell is needed. The page says the tool is flagged by AV because of WinPmem, admin PowerShell use and hash walks.
• AI needs Ollama running. The model can be local or on a separate host that other machines can reach.

What to do

Show usage, then run with case metadata:

PS > powershell -ep bypass Forensicator.ps1 -USAGE
PS > .\Forensicator.ps1 -OPERATOR "Jane Doe" -CASE "IR-2026-001" -TITLE "Workstation triage" -LOCATION "Toronto" -DEVICE "LAPTOP-042"

Running .\Forensicator.ps1 with no flags makes the tool prompt for the case details.

To enable AI, pull a model and edit config.json:

PS > ollama pull mistral:7b-instruct

"ai": {
  "enabled": true,
  "provider": "ollama",
  "base_url": "http://localhost:11434",
  "model": "mistral:7b-instruct"
}

There is no -AI flag. The script reads config.json at startup. To use a remote model host, change base_url.

Caveats

• The author says AI output is a briefing, not a final verdict, and findings should be verified by hand.
• AI slows runs a lot, and the page says a good GPU helps.
• Expect AV alerts. The author advises using the tool only if it suits the environment, and points to other tools otherwise.
• The page does not cover what data goes to a remote Ollama host, the full list of collected artifacts, or the Linux and macOS behavior.